Many current networked devices use traditional software mechanisms to detect intrusions such as viruses, worms and denial of service attacks based on known signatures or patterns. The software mechanisms monitor system behavior and/or incoming traffic and apply appropriately configured filters/signatures to the incoming traffic in order to determine whether or not a system has been infected or is being attacked. However, such an approach is reactive and requires prior knowledge of intrusions or attacks so that appropriate traffic or platform behavior filters can be used by the software mechanisms. Software based firewalls and intrusion detection techniques are susceptible to tamper and can even be circumvented or disabled.
Once infected by a worm/virus, the worm/virus can rapidly spread to other systems before a central management station can provide an updated signature or pattern for the new attack. Moreover, some of the worms/viruses consume significant network bandwidth thereby making it impossible for the remote administrators to reach the infected system and isolate it from the rest of the network. Thus, the entire network or a significant part of it can be infected before appropriate security measures can be taken. Traditional software-based mechanisms for protecting against viruses, worms and denial of service attacks are hence not optimal.